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Abstract 

Wyner's wiretap channel is extended to parallel broadcast channels and fading channels with multiple receivers. 
In the first part of the paper, we consider the setup of parallel broadcast channels with one sender, multiple intended 
' receivers, and one eavesdropper. We study the situations where the sender broadcasts either a common message 

, or independent messages to the intended receivers. We derive upper and lower bounds on the common-message- 

' secrecy capacity, which coincide when the users are reversely degraded. For the case of independent messages we 

\ establish the secrecy sum-capacity when the users are reversely degraded. 

' In the second part of the paper we apply our results to fading channels: perfect channel state information of 

I all intended receivers is known globally, whereas the eavesdropper channel is known only to her. For the common 

' message case, a somewhat surprising result is proven: a positive rate can be achieved independently of the number 

of intended receivers. For independent messages, an opportunistic transmission scheme is presented that achieves 
' the secrecy sum-capacity in the limit of large number of receivers. Our results are stated for a fast fading channel 

,— , \ model. Extensions to the block fading model are also discussed. 

H; 

'"1 , Index Terms 

CJ ■ Wiretap channel, information theoretic secrecy, confidential messages, parallel channels, fading channels, 

\ multiuser diversity, multicasting 
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m . I. Introduction 

0\ ■ 

. A number of emerging applications require a "key distribution mechanism" to selectively broadcast 
CN ' confidential messages to intended receivers. For example in pay TV systems, a content provider wishes to 
^ selectively broadcast a certain program to a subset of customers who have subscribed to it. An online key 
O distribution mechanism would allow the service provider to distribute a decryption key to these intended 
in . receivers while securing it from potential eavesdroppers. The program could then be encrypted via standard 
cryptographic protocols, so that only users who have access to the decryption key could view it. Indeed, in 
the absence of such a mechanism, current solutions rely on variants of traditional public key cryptography 
^ (see, e.g., [5]) and are vulnerable to attacks such as piracy [7]. 

An information theoretic framework for perfect secrecy was developed by Shannon [18], and the problem 
of broadcasting confidential messages was originally formulated by Wyner [22]. Wyner considered a 
special broadcast channel (also known as the wiretap channel): one sender, an intended receiver, and one 
eavesdropper. He characterized the tradeoff between the rate to the intended receiver and the equivocation 
at the eavesdropper when the eavesdropper has a degraded channel compared to the intended receiver. This 
formulation has been generalized for non-degraded broadcast channels in [3], and applied to Gaussian 
channels in [13]. 

While the results for wire-tap channels are rather surprising in that they show that it is possible to 
achieve a positive rate while keeping the eavesdropper in near-perfect equivocation, they also provide some 
disappointing facts for degraded channels, such as Gaussian [13]. First, the secrecy capacity is positive 
only if the eavesdropper is noisier than the intended receiver. This may not be the case in practice. Second, 
in the limit of high signal-to-noise ratio (SNR), the secrecy capacity approaches a constant and does not 
exhibit a logarithmic growth with power. Thus, physical layer secrecy comes at a price in throughput 
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and this may have prompted many practical cryptographic solutions to be based upon other notions of 

security, such as computational security [5]. Note, however, that such solutions require an off-line key 
distribution mechanism which may not be practical in emerging applications. 

The wiretap channel has received renewed interest in some recent works that consider a wireless envi- 
ronment. There the eavesdropper is not always stronger than the intended receivers due to time variations 
in channel gains. These variations in turn can be exploited to communicate securely by transmitting to 
the receivers that have a strong channel. Such coding strategies may yield a practical approach for secure 
communication without an off-line key agreement. 

In the present work we extend Wyner's wiretap channel to parallel broadcast channels with one sender, 
multiple intended receivers, and one eavesdropper. We consider two situations: all intended receivers get 
a common message or independent messages. We first derive upper and lower bounds on the common- 
message-secrecy-capacity. These bounds coincide when the users are reversely degraded. Perhaps the 
main observation is that, to achieve the common message capacity, independent codebooks are used on 
each parallel channel, and each receiver jointly decodes its received sequences. Next, we consider the case 
where the intended receivers get independent messages. We establish the secrecy capacity for the reversely 
degraded case. The achievable scheme is simple: transmit to the strongest user on each parallel channel 
and use independent codebooks across the channels. Our results for the parallel broadcast channels can 
be viewed as generalizations of the results in [6] which considers a similar setup without the presence of 
an eavesdropper. 

Our study on parallel channels provides insights to the problem of broadcasting confidential messages 
over fading channels. In the second part of the paper we consider an i.i.d. fading model. We assume the 
intended receivers' channel state information (CSI) is revealed to all communicating parties (including 
the eavesdropper), while the eavesdropper's channel gains are revealed only to her. 

We first examine the case when a common message needs to be delivered to all intended receivers in 
the presence of potential eavesdroppers. We refer to this problem as secure multicasting. We present a 
scheme that exploits CSI at the transmitter and achieves a rate that does not decay to zero with increasing 
number of receivers. Note that, without a secrecy constraint, transmitter CSI appears to be of little value 
for multicasting over ergodic channels. Indeed the capacity appears to be not too far from the maximum 
achievable rate with a fiat power allocation scheme. The secrecy constraint adds a new twist to the 
multicasting problem as it requires to consider protocols that exploit transmitter CSI. 

For the case of independent messages, we consider an opportunistic scheme that selects the user with 
the strongest channel at each time. We use Gaussian wiretap codebooks for each intended receiver and 
show that this scheme achieves the sum capacity in the limit of large number of receivers. Our results can 
be interpreted as the wiretap analog of the multiuser diversity results in settings without secrecy constraint 
(see, e.g., [20]). 

In related works, the Gaussian wiretap channel was extended to parallel channels in [23]. More recently, 
the case of discrete memoryless parallel channels with one receiver and one eavesdropper has been studied 
in [15], [16]. The wiretap setting has been also studied for fading channels in [1], [10], [17]. All these 
works consider the setup of one sender, one receiver, and one eavesdropper. 

There is also a vast literature on multiuser diversity in broadcast channels with independent messages 
starting from the results in [14], [19]. However, to the best of our knowledge, the present work is the first to 
consider the impact of multiuser diversity on secrecy systems. As discussed before, the case of a common 
message has received much less attention in the literature. The problem of transmitting a common message 
on parallel channels has been studied in [6], [1 1] but we are not aware of a general treatment of this problem 
for fading channels (without an eavesdropper). We hope that the secrecy constraint creates renewed interest 
in the study of common message broadcast problems, given its application to key distribution. 

We use the following notation. Upper case letters are used for random variables and the lower case for 
their realizations. The notation s" denotes a vector of length n. Vector quantities related to the eavesdropper 
have a subscript e, e.g., y" , while the ones of the intended receivers are subscripted by the user number, 
e.g., yf . We use the subscript i to index the receivers and the subscript j to index the channels. We use 
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Fig. 1. An example of reversely degraded parallel channel in Definition [2] with one sender, K — 2 users, one eavesdropper, and AI = 3 
channels. 



the letter t to denote the discrete time index. If there is an ordering of users on a given channel, the 
strongest user on channel j will be denoted by nj. The set of ordered users on channel j is denoted as 
7rj(l), 7rj(2), . . . We use the notation p{Xj) to denote the probability mass function of random variable 



X,. 



II. Parallel Channels: Model 

In our setup, there are M parallel channels for communication, one sender, K intended receivers, and 
one eavesdropper. 

Definition 1 (Product Broadcast Channel): An (M, K) product broadcast channel consists of one sender, 
K receivers, one eavesdropper, and M channels. The channels have finite input and output alphabets, are 
memoryless and independent of each other, and are characterized by their transition probabilities given 
by 

M n 

Pr {{y^^, y^^, y^^, y:,},=i,...,M \ {x]},=i,...m) =1111 ^^vM^ 2/2. • • • , W , 2/e, (t) | x,(t)) 

j=i t=i 

(1) 

for j = 1,2,..., M, where = Xj{l), Xj{2), . . . , Xj{n) denotes the sequence of symbols transmitted 
on channel j, and where y^" = yij{l),yij{2), . . . ,yij(n) denotes the sequence of symbols received by 
user i on channel j from time 1 up to The alphabets of the X/s and F^/s are denoted by X and y 
respectively. 

Of particular interest is a special class of reversely degraded broadcast channels. 

Definition 2 (Reversely Degraded Broadcast Channel): An (Af, K) reversely degraded broadcast chan- 
nel is an (M, K) product broadcast channel, where each of the M parallel channels is degraded in a certain 
order. For some permutation 7rj(l), 7rj(2), . . .nji^K + 1) of the set {1, 2, ... , K, e} of the K + 1-receivers, 
a Markov chain Xj y;^(i) F^^(2) . . . ^ ^tt^ (/<+!) can be specified. 

Remark 1: Note that in Definition [2] the order of degradation can be different across the channels, so 
the overall channel may not be degraded. An example of reversely degraded parallel channel is shown 
in Fig [U Also, on any parallel channels component, the K users and the eavesdropper are physically 
degraded. Our capacity results will, however, only depend on the marginal distribution of receivers on 
each channel (see Fact [T] below). Accordingly, these results also hold for a larger class of channels where 
receivers on each channel are stochastically degraded. 



III. Parallel Channels: Common Message 

In this section we consider the case where all the receivers are interested in only a common message. 
This common message must be protected from the eavesdropper in the sense described below. 

Definition 3: A (n, 2"^) code consists of a message set W = {1, 2, . . . 2"^}, a (possibly stochastic) 
mapping cUn : W ^ X"^ x X"" x . . . x X"^ from the message set to the codewords for the M channels, 

^ V ' 

M times 

and a decoder ^i^n '■ x y" x . ^ x y" ^ W for z = 1, 2, . . . 7^ at each receiver. We denote the 

M times 
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message estimate at decoder i hy Wi. A common-message-secrecy-rate R is achievable if, for any e > 0, 
there exists a length n code such that Pr(11/ 7^ Wi) < e for i = 1,2, . . .K, while 

^H{W\Y:iY:2.---XK)>R-e. (2) 

The common-message-secrecy-capacity is the supremum over all achievable rates. 

Remark 2: Wyner's formulation considers the rate-equivocation region (i?, R^) with ^H{W) > R and 
y^H{W\Y^) > Re. The secrecy-capacity constitutes the special case when R = Re. In the key-distribution 
application of interest, the key length is limited by the equivocation rate Re — the minimum number 
of bits the eavesdropper needs to guess to decode the message. Accordingly, the secrecy capacity is of 
primary interest. 



A. Main Results 

Our main result is the characterization of upper and lower bounds on the common-message-secrecy- 
capacity for the product channel model O. The bounds coincide for the reversely degraded model. 

To state our upper bound we introduce the following additional notation. For any j = 1,2, ... , M, 
let Vj denote the collection of all joint distributions p'{Yij, Y2j, . . . Y^j, Yej\Xj) with the same marginal 
marginal distribution as p{Yij\Xj),p{Y2j\Xj), . . . , p{YKj\Xj) , p{Yej\Xj) . Let V = Vi x V2 x . . . x Vm 
denote the cartesian product of these sets across the channels. 

Lemma 1 (Upper Bound): For the product broadcast channel model in Definition [U an upper bound 
on the secrecy capacity is given by 

M 

-Rft-' = mill max min > I(Xj;Yij\Yei) (3) 

V n-,p(x,).e{i,2,...,i.}^ ^ ^' 

where the first minimum is over all the joint distributions 

Y2,, . . . Ykj, Ye,\x,)}fU e V. 
Lemma 2 (Lower Bound): An achievable common-message-secrecy-rate for the product broadcast chan- 
nel model Definition [T] i^ 

M 

R-'— ^ max . rnin ^{/(f/,; F,,) - /(f/,; Ye,)}^ . (4) 



The random variables Ui,U2, . . .Um are independent over some alphabet U, and each fj-.U^ X, 
J = 1, . . . , M is a (possibly stochasticjl) mapping from the U to X. 

Our upper and lower bounds coincide for the case of reversely degraded product channels. 

Theorem 1: The common-message-secrecy-capacity for the reversely degraded channel model in Def- 
inition [2] is given by 

M 

C— = max . min /(X,; Y,,\Ye,) . (5) 

Note that the expression in ([5]) is evaluated for the joint distribution induced by the reversely degraded 
channel. This distribution is the worst-case distribution in the set P in (|3]). 

Remark 3: Our achievable rate expression in dH) involves optimization over the auxiliary random 
variables Uj and the stochastic mappings /,(■)• As noted in [3], the expression I{Uj; Yij) — I(Uj; Yej) is 
in general not convex in p{Xj\Uj), hence the optimal /,(■) need not be deterministic functions. However, 
for the special reversely degraded case in Theorem [U the choice Xj = Uj is optimal (see Section ITlI-DI) . 

'{u}^ stands for max{0, u}. 

^For each u Ehtj, a stochastic mapping fj-.U^X produces a random element in X. 
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The proof of the upper bound in Lemma [T] is a rather straightforward extension of Wyner's converse for 
the single user wiretap channel. The achievability proof in Lemma |2] is more interesting. When specialized 
to the case of no eavesdropper, it provides a different capacity achieving scheme than the one considered 
in [6]. 



B. Upper Bound 

Fact 1: The common-message- secrecy-capacity for the wiretap channel depends only on the marginal 
distributions p{Yij\Xj) , p{Y2j\Xj) , . . . ,p{YKj\Xj) in ([T]) and not on the joint distribution Y2j, . . . , Y^jlXj] 
for each j = 1,2, . . . ,M. 

The proof of this fact is essentially the same as the proof for broadcast channels without secrecy constraint 
(see, e.g., [3]). 

The following property will be used in the upper bound derivation but, also, in other subsequent proofs. 

Fact 2: For any random variables X, Y, and Z the quantity /(X; Y\Z) is concave in p{X). 
The proof is implicit in the arguments in [21]. We provide it in Appendix IJ for completeness. 
Suppose there exists a sequence of (n, 2"^) codes such that, for every e > 0, as n ^ oo 

Fr{W^Wi)<e, i = l,2,...K 

1 (6) 

-IiW;Y-,...,Y:,,)<e. 

n 

We first note that from Fano's Lemma we have 

^HiW\Yr^,Yr„...,Y^l,)<^ + eR t = l,2,...K. (7) 

Combining ^ and ^ we have, for all z = 1, 2, . . . and e' = e + ^ + eR, 

nR < I{W; YH, Y,l,) - I{W; Y:,, . . . , Y,lj) + ne' 
<I{W;Yr„...,Y^UY:,,...,Y:^)+ne' 

= ^(^il) • • • 5 ^mI^Ji; • • • ; ■^cm) ~ ^(Xily • • • ; ■^iMl^el; • • • ) ■^eM? ^) 

^ "'l-'^jl' • • • 5 jM|-'el5 • • • 5 -'cMJ "'l-'il' • • • 5 -'iMi-' el5 • • • 5 -'eM? ^1 5 • • • 5 •''^ J 

— h(V^ V"- IV" V"- ^ _ hiV^ V" IV" V" "!r" IT" ^ (Sl\ 

— iLyi-^, . . . , . . . , I ^i^) ai^J-j]^, . . . , J-j^l J-gj^, . . . , J-gjy^, y\-]^ , . . . , ^j^j) \0) 

M 



= h{Y-, . . . , Yll,\Y-, Y:,j) - J2 h{Y-\X-, Y-) + ne' (9) 

M M 
M 

<Y,l{Xf,Yl]\Y:;) ^ ne\ (10) 



where d) follows from the fact that W (Xf , . . . Fg'J, . . . , Y^j^.j) (F^^ , . . . , y^^) form a Markov 
chain, and dH) holds because the parallel channels are mutually independent in ([T]) so that 



M 

/i('v" V" IV" V" "ST" y'"- \ — \ ^ /i('v"i V" V 

• • • 5 iMl-'el) • • • 5 -'eM? ^1 ? • • • 5 -^mJ — "'K^ ij \^j ) ^ejJ 
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We now upper bound each term in the summation (flOl ). We have 

n 



k=l 
n 



= Y,nX,{k);Y,,{k),Y,,{k)) - I{X,{ky,Y,^{k)) (12) 
k=i 

= nI{X,- Y,,\Q) - nI{X,- Y,,\Q) (13) 
= nI{X,-Y,,\Y,,,Q) 

<nI{Xf,Y,,\Y,,), (14) 

where (fTTI) follows from the fact that the channel is memoryless,and (fT3l) is obtained by defining Q to 
be a (time-sharing) random variable uniformly distributed over {1, 2, . . . ,n} independent of everything 
else. The random variables (Xj,Fjj, Yej) are such that, conditioned on Q = k, they have the same joint 
distribution as {Xj{k),Yij{k;)^Yej{k)). Finally (fT4l) follows from the fact that the mutual information is 
concave with respect to the input distribution p{Xj) as stated in Fact[2l 
Combining (fT4l) and ^ we have 

M 



M 



mm 

l<i<K ■ 



A/ 



< max mm T HXr,Y,,\Y,,) + e' . (16) 

The above bound (fT6l) depends on the joint distribution across the channels. Accordingly, we tighten 
the upper bound by considering the worst distribution in P = "Pi x x • • • x 'Pm which gives 

M 

i? < min max min N I{Xj;Yij\Yej) + e' . (17) 



C. Lower Bound 

We first informally present the main ideas in our achievability scheme. We construct M independent 
codebooks, one for each channel, denoted as Ci, C2, . . . , Ca/. The structure of the codebooks is shown 
in Fig. [21 Each Cj has 2"(^+^('^J'^=^)) codewords, randomly partitioned into 2"^ message bins — there 
are 2"^^'^^'^'=^^ codewords per bin. Given a message W , the encoder selects M codewords as follows. On 
channel j, it looks into the bin corresponding to message W in Cj and randomly selects a codeword 
in this bin. Each intended receiver attempts to find a message that is jointly typical with its received 
sequences. An appropriate choice of R guarantees successful decoding with high probability for each 
intended receiver, and near perfect equivocation at the eavesdropper. 

We now provide a formal description of our coding scheme. 

Fix the distributions p(Ui) , p{U2) , ■ ■ ■ ,p{Um) and the (possibly stochastic) functions /i(-), . . . , fivii-)- 
Let Be and sr be positive constants, to be quantified later. With respect to these quantities, define 

M 

^ = i^jP^S^^^^^^' ^'^^ " ^^^-^^^ ~ ^« (18) 

Rej = I{Uj- Fe,) - J = 1, 2, ... M. 
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Q2 = 2"(^(''2i''=)-^*-) CWs per Bin 
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Codebook Ci Codebook C2 

Fig. 2. Structure of the codebooks in our coding sclieme for tire case of two parallel channels. Each codebook has 2"^ message bins 
and Qj ^ 'T^i'J^i'Yc,)) codewords per message bin. Thus the size of bins depends on the mutual information of the eavesdropper on the 
corresponding channel. This flexible binning enables to confuse the eavesdropper on each channel. Note that Ci and C2 above have the same 
number of rows but different number of columns. The codewords for message Wk in Cj are labeled as w"i(wfc), . . . w"q^. (wk) 



In what follows, whenever typicality is mentioned it is intended to be weak typicality (see, e.g., [2]). 
The set T{Uj) denotes the set of all sequences that are typical with respect to distribution p{Uj) and 
the set T{Xj, Uj) denotes the set of all jointly typical sequences (x", w") with respect to the distribution 
p{Xj,Uj). Tun.[Xj\Uj) denotes the set of all sequences conditionally typical with respect to a given 
sequence according to p{Xj\Uj). 

1) Codebook Generation: 

• Codebook Cj for j = 1, 2, . . . , M has a total of Mj = 2"^(^+^«3) length n codeword sequences. Each 
sequence is selected uniformly and independently from the set T{Uj). 

• We randomly partition the Mj sequences into 2"^ message bins so that there are Qj — 2"^«^ 
codewords per bin. 

• The set of codewords associated with bin w in codebook Cj is denoted as 

Cj{w) = {u],{w),u],{w),...,u]Q.{w),}, «; = 1,2,...2»^ j = l,2,...M. (19) 

Note that Cj — U^=i^j (^) codebook on channel j. 

2) Encoding: To encode message w, the encoder randomly and uniformly selects a codeword in the 

set Cj{w) for all 1 < j < M. Specifically, 

• Select M integers ki,k2,... , /cm> where kj is selected independently and uniformly from the set 
{1,2,...Q,}. 

• Given a message w, select a codeword u^k.{w) from codebook Cj{w) for j = 1, 2, . . . M. 

• The transmitted sequence on channel j is denoted by = Xj{l),Xj{2), . . . , Xj{n). The symbol Xj{t) 
is obtained by applying the (possibly stochastic) function fj{-) on the t^^ element of the codeword 

3) Decoding: Receiver i, based on its observations {y^^-,y''^-, ■ ■ ■ iVm) from the M parallel channels, 
declares message w according to the following rule. 

• Let Si — < j < M, I{Uj;Yij) > I{Uj;Yf,j)} denote the set of channels where receiver i has 
larger mutual information than the eavesdropper. The receiver only considers the outputs yfj from 

these channels. 

• Receiver i searches for a message w such that, for each j e Si, there is an index Ij such that 
{u^i.{w),y^j) E T{Uj, Yij). If a unique w has this property, the receiver declares it as the transmitted 
message. Otherwise, the receiver declares an arbitrary message. 
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4) Error Probability: We show that, averaged over the ensemble of codebooks, the error probability 
is smaller than a constant e' (to be specified), which approaches zero as n ^ oo. This demonstrates the 
existence of a codebook with error probability less than e' . We do the analysis for user i and, without 
loss of generality, assume that message wi is transmitted. 

. False Reject Event: Let £1^ be the event {(f/j\(uii), F^") ^ T{Uj,Y,j)}. Since f/j^ e T{Uj) by 
construction and Yij is obtained by passing Uj through a DMC, it follows that Pr(£^fj) < 5, where 
5 — > as e 0. Accordingly if £^ denotes the event that message wi does not appear typical, then 
we have 

Pr(£^) = Pr (^U^y j < (20) 

• False Accept Event: As before, let Si C {1,2, . . . , M} denote the subset of channels for which 
I{Uj] Yij) > I{Uj] Yej). In what follows the index j will only refer to channels in S^. 
Let Srj denote the event that there is a codeword in the set Cj{wr) (r > 1) typical with Y^^. Also let 
£r be the event that message Wr has a codeword typical on every channel. 

FriSrj) = Pr(3/ G {1, 2, . . . , Q,} : Y,^) G T([/,, Y,^)), j E S 

Qo 

<J2mU^i{wr),Y,^) eT{U„Y,,)) 
1=1 
Qj 

1=1 

where the last inequality follows since = 2^inur,Ye,)-ep)_ Finally, the probability of Sr can be 
computed as 

Pr(^,) = Pr(f|^,,) 

= H Pr(f,,) (21) 

^ 2-^T,ieS^nUy,Y^,)-IiUJ■,Y,,)-3e+eF) 
= 2-'^T.■Lli{nUf,Y^J)-I(Ur,YeJ)}+-3e+ep)^ 

where (|2T]) follows by independence of codebooks and channels. The probability of false accept event 
£f is then given by 



Pr(£^) = Pr(|j£, 



r=2 



^ 2nR2~nJ:fL^{{I{UJ■Y^J)-IiUy,Y,,)}+-3S+eF) 
^ 2-n{3M5-MeF+eii) 

which vanishes with increasing n for any Er and Sp that satisfy the relation £ji > Msp — 3M5 > 0. 
The probability of error averaged over the ensemble of codebooks is less than 
e' = max [M5, 2""(3M5-MeF+£fl)j_ jj^jg demonstrates the existence of a codebook with error proba- 
bility less than e'. 



9 



5) Secrecy Analysis: We now bound the equivocation at the eavesdropper for a typical code in the 
ensemble. Informally, since the codebook Cj has 2"'^^(^^'^'=j)^^^) codewords per bin, the eavesdropper's 
equivocation is near perfect when observing the output of channel j, i.e., ^I{W; Y^) < e'p for some e'p 
(to be specified) such that e'^ — > as 0. Since we are sending the same message on each of the 

M channels, the eavesdropper can potentially reduce the equivocation by combining the channel outputs. 
However in doing so, his equivocation reduces by at most Me'p since the codewords on each channel are 
independently selected!! 

The following Lemma is proved in Appendix |lll 

Lemma 3: A typical code from the ensemble in our achievability scheme satisfies the following: For 
any j = 1, 2, . . . M, we have -^liW; Y^) < e'p, where e'p = e'p{6, ep) tends to zero as 5 ^ and ep 0. 

Using the above lemma we now upper bound the mutual information at the eavesdropper as 

ll(W- . . . , = M^i, • • • , ^m) - KY-, Y:,,\W) (22) 

m 

= h{Y:„ y:,,) - h{Y:^\w) (23) 

M 

<J2HW;Y:;)<Mne'p, (24) 
i=i 

where h{Y^^, . . . , Y^,^\W) = ^™ ^ h{Y^\W) since the codewords in the sets Ci{W),C2{W), ...,Cm{W) 
are independently selected. 

Hence the normalized mutual information increases only by a fixed amount due to observations on 
multiple channels. By choosing e in (|2]) to equal Me'p, we satisfy the secrecy constraint. 



D. Capacity Result of Theorem [7] 

The result of Theorem [T] follows directly from Lemma [T] and [2l For the reversely degraded broadcast 
channel we have, for all i and j, that either Xj — * Yij — > or Xj Y^j Yij holds. If Xj — > Yjj — > Y^j 
holds, then 

I{Xj] Yij) — I{Xj] Y(,j) = I{Xj] Yij, Yej) — I{Xj] Yej) 

Instead, if Xj Y^j — > Yij, then I{Xj]Yij\Yej) = 0. In either case we can write I{Xj]Yij\Yej) = 
{liXj] Yij) - I{Xj; Fej)}^- Substituting this in © we have 

M 

Rt~< min V{/(X,;F.,)-/(X,;F,)K, (25) 

which coincides with our achievable rate in (HI) when we choose Uj = Xj. 

As a special case of Theorem [H we have the following corollary for the case of one receiver and one 
eavesdropper. 

Corollary 1 (Single User case): Consider the reversely degraded parallel channels in Definition |2] with 
one receiver and one eavesdropper. The secrecy capacity is given by 

M 

Ci,M= max y^I{Xj;Yj\Y,j) . (26) 

^It is important that the codewords be independently selected. If they are not, say the same codeword is repeated on each channel, the 
eavesdropper equivocation can be significantly reduced by combining the channel outputs. 
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Fig. 3. Two coding schemes for common message transmission on proposed ciiannels. The top figure shows the scheme proposed in 
Theorem [T] It achieves the common message capacity. In this scheme we use independent codebooks on each parallel channel. This allows 
us to separately bin on each channel. The lower figure shows the scheme that uses a single codebook. While this scheme is optimal when 
there is no eavesdropper [6], it is suboptimal in our setup. This drawback of this scheme is that because of the single codebook, one cannot 
separately bin for each channel. 



Remark 4: The single user result admits a simple coding scheme. Split the message W into M sub- 
messages Wi,W2, ■ ■ ■ ,Wm and independently encode and decode message Wj on channel j with a 
codebook of rate Rj = I{Xj;Yj\Yej). With multiple receivers however, this simple scheme is limited 
by the worst user on each parallel channel and does not achieve the secrecy capacity. 

E. Sub-optimality of a Single Codebook scheme 

The capacity of common message for reversely degraded broadcast channels in Definition |2] without 
the secrecy constraint is [6] 

M 

^No^Secrecy^ min V /(X^' ; Fi^ ) • (27) 

The achievability scheme in (|T7l) uses a single codebook with codewords of dimension M x n. The 
component of the codeword is a length n sequence sampled from an i.i.d. p{Xj) distribution and is 
transmitted on channel j. 

Our achievable scheme is different from this single codebook scheme since we use independent code- 
books on each parallel channel. Note that this distinction is important in achieving the secrecy capacity 
in Theorem [TJ The distinction between these schemes is shown in Fig. [3l An achievable rate using the 
single-codebook scheme in our setup is 

R^'^^'"' = max min {/(Xi, ...Xk, l^.i, • • • Y^k) - /(Xi, X2 . . . Xk, Y,,, . . .Y,k)} ■ (28) 

p{Xi,X2,...,XM)ie{l,2,...K} ^ 

Note that, in general, the rate (l28l) is smaller than The intuition behind this is that, by using 
an independent codebook on each parallel channel, it is possibly to separately tune the bin size on 
each channel according to the degradation of the eavesdropper. Finally note that our proposed scheme 
also provides an alternative way to [6] to achieve the common message capacity in the absence of an 
eavesdropper. 

"'The two expressions coincide if, for example, the eavesdropper is degraded with respect to all the receivers on all the channels, i.e., 
Xj Yij Yej for every I < i < K and I < j < M . 
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F. Gaussian Channels 

We consider the Gaussian channel model where 

•y V _i_ 7 

with Zij ~ A/'(0,crf^) and ~ A/'(0,(Tgj). All these noise variables are assumed independent. We also 
impose an average power constraint ^|] — 

Corollary 2: The common-message-secrecy-capacity for the Gaussian parallel broadcast channel in (|29l ) 

is 

^c—,Gaussran ^ ^in V l ^ log f 1 + 4 V ^ log f 1 + ' (^O) 

(Pi,P2,...PM)6^i<^<i^^ i2 ^ \ 4/i 

where JF is the set of all feasible power allocations that satisfy J2jLi Pj — P- 

To prove Corollary [21 first observe that the channel in (|29l ) has the same capacity as the corresponding 
reversely degraded broadcast channel (see Fact [T]) given by the following model: on channel j, let 
7rj(l), . . . ,7ij{K + 1) denote set of intended receivers and eavesdropper ordered from the strongest to 
the weakest. For each < k < K, the channel for user 7rj{k + 1) is Y^^(^k+i)j = Y^j{k)j + Z^j with 
F^^(o)j = and crl(o)j = 0. The noise random variables Z^j ~ A/'(0, cr^^fc^i)^- — are independent. 

Since /(X^; Fjj|Yej) is a continuous and concave function in p{X) (see Fact|2l), we use discretization 
arguments (see, e.g., Ch. 7 in [8]) to extend Theorem [T] to the Gaussian case 



M 



/^common 
'--■KM 



(P) = max min /(X,; • (31) 



n,=ip(^.) 



Now observe that ma.Xp(^Xj),E[x'^]<Pj H^j'^ ^ijl^ej) denotes the capacity of a Gaussian wiretap channel [13]. 
Accordingly we have 



max 

p{X,),ElX^]<Pj 



J(X,; = log (l + ^) - ^ log (l + ^) }^ • (32) 



One then deduces (l30l). 



IV. Parallel Channels: Independent Messages 

We consider the case of M parallel channels, one eavesdropper and K receivers, each interested in an 
independent message. Each such message must be protected from the eavesdropper. We now define the 
achievable rate for the case of independent messages. 

Definition 4 (Length n Code): A (2"^^, 2"^^^ ^ 2"^^, n) code for the product broadcast wiretap chan- 
nel in Definition [T] consists of a mapping u;„ : Wi x W2 x . . . x Wk ^Y" x . . . X^^ from the messages 

Aftimes 

of the K users to the M channel inputs and K decoding functions : 3^" x 3^" x . . . x 3^" ^ Wj, one 

M times 

at each intended receiver. We denote the message estimate at decoder i hy Wi. A perfect-secrecy-rate tuple 
(i?!, -R2, • • • , Rk) is achievable if, for every £ > 0, there is a length n code such that Pr(iyi 7^ Wi) < e 
for alH = 1, 2, . . . , K, and such that the following condition is satisfied 

^H{W,\W^, . . . , ...Wk.Y:^.... Y:m) > ll^iW) -e, ^ = 1, 2, . . . M. (33) 

The secrecy-sum-capacity CJ^"^ is the supremum of -Ri + i?2 + • • • + Rk over the achievable rate tuples 
{Ri, R2, ■ ■ ■ , Rk)- 
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Remark 5: Our constraint (|33l) provides perfect equivocation for each message, even if all the other 
messages are revealed to the eavesdropper. It may be possible to increase the secrecy rate by exploiting 
the fact that the eavesdropper does not have access to other messages. This is not considered in the present 
paper. 



A. Main Results 

Our main result is an expression for the secrecy-sum-capacity for the reversely degraded broadcast 
channel in Definition [2l 

Theorem 2: Let tTj denote the strongest user on channel j. The secrecy-sum-capacity for the reversely 
broadcast channel is given by 

M 



Furthermore, the expression in (1341) is an upper bound on the secrecy- sum-capacity when only the intended 
users are reversely degraded — but the set of receivers together with the eavesdropper is not degraded. 
The remainder of this section will be devoted to the proof of Theorem [21 and some discussion. 



B. Proof of Upper Bound in Theorem |2] 

We establish the upper bound in Theorem [2l Suppose a genie provides the output of the strongest 
receiver, iXj, to all other receivers on each channel, i.e., on channel j the output Y^, is made available to 
all the receivers. Because of degradation, we may assume, without loss of generality, that each receiver 
only observes {Y^^^ . . . ,Y^^J. Clearly, such a genie aided channel can only have a sum capacity larger 
than the original channel. Since all receivers are identical, to compute the sum capacity it suffices to 
consider the situation with one sender, one receiver, and one eavesdropper. 

Lemma 4: The secrecy-sum-capacity in Theorem [2] is upper bounded by the secrecy capacity of the 
genie aided channel, i.e., < C^^^^^^^^^'^ . 

Proof: Suppose that a secrecy rate point i?2, • • • Rk) is achievable for the K user channel in 
Theorem [2] and let the messages be denoted as (VTi, W2-, ■ ■ ■ Wk)- This implies that, for any e > and n 
large enough, there is a length n code such that Pr(lVj 7^ Wi) < e for i = 1, 2, . . . , K, and such that 

-H{W,\W,, . . . W,.i, ...Wk, Y:„ Y:„ Y^^) > R^ - e . (35) 
n 

We now show that a rate of (Xlili 0; • ^" ' achievable on the genie aided channel. First, note 

K-l 

that any message that is correctly decoded on the original channel is also correctly decoded by user 1 
on the genie aided channel. It remains to bound the equivocation on the genie aided channel when the 
message to receiver lisW = {Wi, W2, . . ■ , Wk). We have 

-Hiw\Y:,, y:,, . . . , y:,,) = -h{w,, w^,..., wk\y:^, ^2, • • • , ni/) 

n n 

K 1 

> V -H{W,\Wr, . . . W,.,, ...Wk, ^I, ^2, • • • , ^m) 
^-^ n 

i=l 
K 

>^Ri-Ke 

i=l 

where the last step follows from (l35l) . Since e is arbitrary, this establishes the claim. ■ 
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Lemma 5: The secrecy capacity of the genie aided channel is 

M 

^GenieAided^ HiaX V /(X. ; . I Fe, ) • (36) 

Proof: Since all receivers are identical on the genie aided channel, this Lemma is a direct consequence 
of Corollary [T] when specialized to the case of i^' = 1 receiver. ■ 
Remark 6: The upper bound continues to hold even if the eavesdroppers channel is not ordered with 
respect to the intended receivers. In general, following Lemma [H the upper bound can be tightened by 
considering, for all 1 < j < M, the worst joint distribution p'{YT,.,Y(,j\Xj) among all joint distributions 
with the same marginal distribution as p(F^jXj) and p{Yej\Xj), yielding 

M 

C^^Jj< min max J] J(X,; l^Ji;,). (37) 

C. Achievability Scheme 

Our achievability scheme for Theorem [2] requires the receivers and the eavesdropper to be reversely 
degraded. We only send information intended to the strongest user, i.e., only user iXj on channel j can 
decode. It follows from the result of the wiretap channel [22] that a rate of Rj = maxp(x^) H-^j'^ ^TrJ^ej) 
is achievable on channel j. Accordingly the total sum rate of J2j achievable which is the capacity 
expression. 

Remark 7: The "opportunistic transmission" strategy in Theorem [2] has been previously observed in 
the absence of an eavesdropper [14], [19] in the context of fading channels. Hence our result states that 
the optimality of opportunistic transmission also holds in the presence of an eavesdropper. Our converse 
technique, when applied to the case of no eavesdropper, also provides a simpler argument for the optimality 
of opportunistic transmission studied in [14], [19]. 

D. Gaussian Channels 

Theorem |2] can be extended to the case of Gaussian parallel channels. Let a^. denote the noise variance 
of the strongest user on channel j. Then the secrecy-sum-capacity is given by 

AI 



(Pi,P2,-Pm) . 




where the maximization is over all power allocations satisfying J2jLi — ^- The achievability follows 
by using independent Gaussian wiretap codebooks on each channel and only considering the strongest 
user on each channel. For the upper bound we have to show that Gaussian inputs are optimal in the 
capacity expression in Theorem [2l The justifications are the same as in the common message case in 
Section HIlFI 

V. Fading Channels 

The second part of this paper considers wireless fading channels. The case of one receiver and one 
eavesdropper has been recently studied in a number of recent works [1], [10], [12], [15]-[17]. The proposed 
schemes adapt the transmission power and/or rate depending on the instantaneous channel conditions. The 
time varying nature of the fading channel enables secure transmission even when the eavesdropper has 
an average channel stronger than that of the intended receiver. 

To the best of our knowledge, the above works do not consider secure transmission to multiple receivers 
in a wireless fading environment. We first consider the case when a common message has to be delivered to 
a set of intended receivers. Next, we consider the case when each receiver obtains an independent message. 
For this setting, we present a scheme based on multiuser diversity that achieves the sum capacity in the 
limit of a large number of receivers. 



14 



A. Channel Model 

A block fading channel model for a system with one sender, K receivers, and one eavesdropper is of 
the form 

y,(t) = /i,(t)x(t) + z,(t), z e {l,2,...ir,e}, t G {1, 2, . . . (39) 

where i denotes the index of the receiver and t denotes the time index. The vectors Zj,x, yj are T 
dimensional complex valued vectors, where T denotes the coherence period of the channel. The channel 
coefficients hi(t) are constant over a block of T symbols and change independently over the blocks. 

In our analysis we focus only on the fast-fading scenario, i.e., T = 1. Using interleaved codebooks we 
can realize the fast-fading case even when T > 1. The fast-fading channel model is of the form 

y,{t) = hi{t)x{t) + Zi{t), ^ G {l,2,...ir,e}, tG{l,2,...n} (40) 

where the hi(tys are sampled independently from CJ\f{0,jJi) distribution and all the noise variables are 
sampled independently according to CJ\f{0, 1). The input satisfies an average power constraint < 
P. 

Throughout, we assume the hi{tys to be revealed to the transmitter, the K intended receivers and the 
eavesdropper in a causal manner. Implicitly we assume that there is an authenticated public feedback link 
from the receivers to the transmitter. The channel coefficients of the eavesdropper {he{t)}i<t<n are only 
known to the eavesdropper. The transmitter and the intended receivers only have statistical knowledge of 
the eavesdropper's channel gains. 

Remark 8: In our setup we are assuming only one eavesdropper. Note however that the equivocation 
term depends only on the statistics of He{t) and not on the realization of he{t). Accordingly the number 
of eavesdroppers does not matter as long as they are statistically equivalent and do not collude. 

VI. Fading Channels: Common Message 

Secure multicasting refers to the case when each receiver is only interested in a common message. The 
transmitter exploits the channel knowledge of intended receivers to selectively broadcast the message to 
these receivers, while the eavesdropper remains ignorant of the message. Note that without the secrecy 
constraint, a non adaptive scheme such as the one that does a flat power allocation with no transmitter 
CSI, appears to be not too far from the optimal. In contrast such schemes reveal the message to an 
eavesdropper with a channel statistically equivalent to some intended receiver. 

Perhaps, an interesting question is the scaling of the secrecy capacity with the number of receivers. 
Does the capacity decay to zero with the number of receivers? Note that the scheme that consists in 
sending information only when all the users have a strong channel performs poorly. Since the channel 
gains across the users are independent, the achievable rate decays to zero exponentially in the number of 
users. 

An obvious upper bound is the secrecy capacity with a single receiver. Accordingly, the best we 
hope for is that the common message secrecy-capacity is a constant, independent of the number of 
intended receivers. In what follows, we present a coding scheme whose achievable rate is also a constant, 
independent of the number of intended receivers. While our proposed scheme provides optimal scaling, 
the precise value of the constant remains an open problem. 

We now provide a formal definition of the common-message-secrecy-capacity. 

Definition 5: A (n, 2"^) code for the channel consists of an encoding function which is a mapping from 
the message w E {1, 2, ... , 2"^} to transmitted symbols x{t) = uJt{w; h\, h^, . . . , /i^) for t = 1, 2, . . . , ra, 
and a decoding function at each receiver Wi = 4>i{yi] h", . . ■ , h]^) for each i = 1,2, . . . , K . A rate R is 
achievable if, for every e > 0, there exists a length n code such that Pr(iyj ^ W) < e for i = 1,2, ... ,K 
and such that 

-H {W I H:, hi hi ...,Hl)>R-e. (41) 
The entropy term in (|4TI) is conditioned on if", . . . , H"^ as the channel gains of the K receivers are 
assumed to be known to the eavesdropper. 
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A. Main Results 

Our main result is an achievable rate for the common-message-secrecy-rate to K receivers. 
Theorem 3: An achievable common-message-secrecy-rate for the channel model ( |40l) is given by 

^common^p) = min E \{\og{l + \Hi\'^P) - ^[log(l + \H,\^P)]}+] (42) 

l<i<K 

If all the users are i.i.d. Rayleigh faded with = 1, the following can be readily verified 

lim R^"^^°^(p) = 0.7089 bits/symbol (43) 

P— >oo 

Note that the achievable rate in (l42l) and (|43] ) does not depend on the number of receivers. Accordingly, 
we do not subscript the rate by K. That the capacity does not decay with the number of receivers is the 
best scaling of the capacity with the number of receivers that one can expect. 

The "interesting" part of our achievability rate (l42l) is the {■}+ inside the expectation. This is essentially 
a consequence of the multiple codebook scheme we presented for the parallel channel case in Section |llll 

Our approach to establish the achievability of (l42l) is to decompose the fading channel into a set of 
parallel channels and invoke Lemma [21 for the probabilistic extension of the parallel broadcast channel. 

B. Achievability Scheme 

First we consider the following probabilistic extension of the parallel broadcast channel [14]: At each 
time, only one of the parallel channel operates and channel j is selected with a probability pj, independent 
of all other times. Also suppose that there is a total power constraint P on the input. A straightforward 
extension of Lemma [2] provides the following achievable rate 

M 

R—{P) = max min Y,,) - I{U,- Y,,)}\ (44) 

i=i 

where Ui,U2, ■ ■ ■ Um are auxiliary random variables and the maximum is over the product distribution 
p{Ui)p{U2) . . -piUM) and the stochastic mappings X,j = fj{Uj) that satisfy J^jLiPj^l^j] ^ -P- 

Next, we map the fading channel (l40l) into a set of parallel channels and invoke the achievable rate (l44l) . 
However, we need to resolve the technicality in that the fading channel has continuous valued fading 
coefficients, while the rate expression in (l44l) is only for a finite number of parallel channels. Following [9], 
our approach is to discretize the continuous valued coefficients and thus create parallel channels, one for 
each quantized state. The number of parallel channels increases as the quantization becomes finer. In 
what follows we only quantize the magnitude of the fading coefficients. The receiver can always rotate 
the phase, so it plays no part. 

We quantize the channel gains into one of the q values: Ai = < A2 < . ■ . < Ag^i = 00. Receiver i 
is in state / G {1, 2, . . . , g} at time t if Ai < \Hi(t)\'^ < Ai^i. When in state /, the receiver's channel gain 
is pessimistically discretized to y/Ai. Since there are K independent users, there are a total of M = 
possible super-states, which we number as Si, S2, ■ ■ ■ , Sm- Denote the quantized gain of user i in Sj by 
the double subscript Sij. Let p{Sj) denote the probability of state Sj. Also let Pi{Ai) be the probability 
that a user i is in state / i.e., Pi{Ai) = J2kLi-s k=AiP('^k)- In super-state Sj, the channel of user i and the 
eavesdropper are 

Vijit) = ^/S^jxit) + Zi{t), 

yel{t)=He{t)x{t)+Ze{t). 

By selecting Uj ~ CA/'(0, P) and Xj = Uj, the argument in the summation in (l44l) (with the eavesdropper 

output (Fei, He)) is 

{/(f/,; ¥,,) - I{Uf, Fe„ H,)Y = {/(X,; F,,) - /(X,; H,)Y 

= {I{Xj] ^/^jXj + Zi) — I{Xj] HeXj + Ze, He)}^ 

= {log(l + S,,P) - E[\og{l + \H,\^P]y. 
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Substituting in (|44l) . we have that the following rate is achievable 

AI 

R—n^p^ ^ mm ^j9(S',){log(l + SijP) - E[\og{l + m^P)]}+ (45) 

q 

= min Vp,(AO{log(l + AP) - E[\og{l + m^P)]}+, (46) 

l<i<K ' 
1=1 

where the second equality follows from rewriting the summation over the states of each individual user. 
As g — CX3, the above sum converges to 

POO 

min / {log(l + xP) - E[\og{l + \He\'^P)]}+pi{x)dx (47) 

l<i<K Jq 

= min E [{log(l + \H,\^P) - E[log(l + \He\'P)]}^] , (48) 

yielding (|42l) . 

Remark 9: The scheme presented above requires codebooks, where q is the number of quantization 
bins. A different decomposition which requires only 2^ codebooks and provides the same achievable rate 
is presented in Appendix Hill This scheme can be implemented in practice with an outer erasure code and 
an inner wiretap code, as discussed in [12]. 



VIL Fading Channels: Independent Messages 

We consider the case where each receiver wants an independent message. We will only focus on the sum 
rate of the system. This scenario has been widely studied in conventional systems (i.e., without a secrecy 
constraint) where the transmitter CSI provides dramatic gains (see e.g., [14], [19]). An "opportunistic 
scheme" that selects the user with the largest instantaneous gain maximizes the sum-rate of the system. 
The results in this section can be interpreted as an extension of opportunistic transmission in the presence 
of eavesdroppers. 

Definition 6: A (n, 2"^\ . . . , 2"^^) code consists of an encoding function from the messages wi, . . . , wk 
with Wi G {1, 2, . . . , 2"^'} to transmitted symbols x{t) = ujt{wi,W2., ■ ■ ■ ■,WK]h\,h\, . . . ,h^j^) for t = 
1, 2, . . . , n, and a decoding function at each receiver Wi = 4>i{y^] /i" , hl^, ■ ■ ■ , h^). A rate tuple (-Ri, -R2, • • • , Rk) 
is achievable with perfect secrecy if, for any e > 0, there exists a length n code such that, for each 
i = 1,2,. . . ,K, with Wi uniformly distributed over {1, 2, ... , 2"^*}, we have PT{Wi Wi) < e and 




W,,. . . ,W,.i,Wi+^, . . . ,Wk,H:,H^,. . . ,H^ j >Ri-e. (49) 
The secrecy-sum-capacity is the supremum value of Ri + R2 + ■ ■ ■ + Rr among all achievable rate tuples. 
A. Main Results 

In the following, let ifmax denote the largest instantaneous channel gain among the K users. We first 
upper and lower bound the secrecy-sum-capacity. 

Lemma 6: For the channel model (|40l) . the secrecy-sum-capacity is upper and lower bounded as 

R+{P) = max E [{log(l + \H^..\^P{H^,^)) - log(l + \HfP{H^,^))}+] (50) 

and 

R-^{P) = max E [log(l + \H^.^^P{H^^^)) - log(l + \H,\^P{H^^^))\ , (51) 

respectively, where {v}^ denotes the max(0,f). 
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The difference in our lower and upper bounds in (|50l ) and (|5T1) is that the {■}+ operator is inside the 
expectation in our upper bound but not in the lower bound. Thus the "loss" with respect to the upper 
bound occurs whenever |i/niaxP < l-^eP- As the number of intended receivers grows this event happens 
rarely and the gap between the upper and lower bounds vanishes. Formally we have 

Theorem 4: The gap between our upper bound R^{P) and the lower bound Rj^{P) in Lemma [6] 
satisfies 



R+{P) - R],{P) < Ft{\H,\^ > \H^..\^)E 



log 



-'-'max 



I Hp I > I Hn 



(52) 



The bounds coincide in the limit K ^ oo when all the channel gains are sampled from CJ\f{0, 1] 



/^sum 



max 

,y.E[PiHn 



]<p 



E [log(l + |i/max|'P(i/max)) - log(l + \H,\^ P (H^,^,))] + o(l), (53) 



where o(l) ^ as K ^ oo. 

The result of Theorem |4] shows that opportunistic transmission in conjunction with single user Gaussian 
codebooks achieves the optimal sum secrecy-rate in the limit of large number of receivers. 

Remark 10: To the best of our knowledge, the secrecy-sum-capacity for a finite number of receivers 
has not been resolved for the fast fading model (l40l) . When the coherence period is large enough so 
that one can invoke random coding arguments in each period, it appears possible to extend the single 
receiver result in [10] to determine the secrecy-sum-capacity for finite number of users. We elaborate this 
connection later in the section IVII-FI 

Our upper and lower bounds do not coincide for a finite number of users. Nevertheless, the high SNR 
limit provides a convenient operating regime for numerical evaluation of the bounds. 

Corollary 3: We have 



lim R^iP) = E 



log 



\Hrr 



\Hp 



lim R-^iP) = maxPr(|/7^axr > T)E 



log- 



\Hr, 



\Hp 



> T 



(54) 



B. Upper Bound in Lemma |6| 

Our proof technique is to introduce a single user genie-aided channel as in Section |IV] and then to upper 
bound this single user channel. This upper bound on the genie aided channel is closely related to an upper 
bound provided in [10] for the slow fading channel. We nevertheless provide a complete derivation in 
Appendix |IVl 



C. Achievability in Lemma |6| 

The achievability scheme combines opportunistic transmission and a Gaussian wiretap code. At each 
time, only the message of the user with the best instantaneous channel gain is selected for transmission. 

As in Section [VTBi we quantize each receiver's channel gain into q levels Ai = < A2 < ■ ■ ■ < Aq < 
Aq^i = 00. Since the channel gains of the K users are independent, there are a total of M = different 
super-states. These are denoted as Si, S2, ■ ■ ■ , Sm- Each of the super-states denotes one parallel channel. 
Note that on each parallel channel, the intended users have a Gaussian channel, while the eavesdropper 
has a fading channel. 

Our scheme transmits an independent message on each of the M parallel channels. Let Gj E {Ai, A2, . . . , Ag} 
denote the gain of the strongest user on channel j. We use a Gaussian codebook with power P{Gj) on 
channel j. The achievable rate on channel j is 

R, = IiU,;Y,)-I{Uf,Y,j,H,,) 

= log(l + GjPiG,)) - i?[log(l + \HfPiG,))], 
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where the second equality follows from our choice of Xj = Uj ~ J\f{0, P{Gj)). The overall achievable 
sum rate is given by 



M 



M 

= 5^Pr(^,)(log(l + G,P(G,)) - i?[log(l + WP{G,m 
q 

= J2 Pr(A)(log(l + AP{A,)) - E[log(l + \H,\'PiAi))]), 



1=1 



where the last equality follows by using the fact that Gj E {Ai, A2, . . . , Aq} and rewriting the summation 
over these indices. As g ^ cxd, 



(•00 



RKiP) 



/ (log(l + aP{a)) - E[log(l + \H,\^Pia))])p{a)da 
Jo 

E [log(l + |i/n.axrP(i/max)) " log(l + \H,\^ P (H^^,))] 



which establishes (|5T1). 



(55) 



D. Proof of Theorem |?] 

Let P*{H^s^x) be the power allocation that maximizes R^(P) in (|50l ). We have 

R+{P) - Rk{P) < E [{log(l + |i/max|'P*(i^max)) - log(l + \H,\^ P* {H^,,))}+] 

- E [log(l + |if„,axrP(^max)) - log(l + \H,\^ P (H^,^))] 



Prim' > m..nE 



< Pr(|ife|' > \Hn 



)E 



log 
log 



1 + li^el 


^P*(H ) 


1 + 1 


^max 


\'^P*(H ) 



I Hp I > I Hr, 



max 



-f^ e _ max 



< 



1 



K + l 



2 log 2 



where the first step follows substituting the bounds in [6l the third step follows from the fact that 
log i^^"^ is increasing in a for |-f^eP > l-f^maxp, and where the last step follows from Lemma [8] 
(proved in the Appendix IVT) and the fact that Pr(|ifeP > l-f^maxP) = 1/(1 + -^)' since we assumed the 
channel coefficients to be i.i.d. 



E. Proof of Corollary \3\ 

The upper bound follows from the simple identity, that for every P > 0, 



log 



1 + 1 


^max 


|2p 


1 + 




2p 



(56) 



For the lower bound, we use a two level power allocation strategy in (dTI) . Fix a threshold T > and 



let 



Po 



l-f^rr 



P(^max) = < ° ~ Pr(|Hn,axP>T) l^^^ax 

otherwise. 



> T 



(57) 
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Fig. 4. Upper and Lower bounds in tiie Higli SNR limit (c.f. i54\ ) for the i.i.d. Rayleigh fading case. The y-axis plots the bounds in 
nats/symbol while the x-axis plots the number of users. 

This choice gives an achievable rate of 

R],{P) = Pr(|i7^ax|' > T)E 

The argument inside the expectation is bounded by -E[log ''^^'"p ] -Po > 0. Hence by the dominated 

convergence theorem the limit P ^ oo and the expectation can be interchanged. Accordingly we have 

lim i?^(P) = Pr(|i7.,,.|2 > T)E 

= Pr(|/f^,.|2 > T)E 
which gives the desired result. 
E Discussion 

Theorem |4] guarantees an arbitrarily small gap between upper and lower bounds on the sum- secrecy- 
capacity, that holds for any fixed coherence period, provided the number of users is large enough. 

In [10] two schemes are presented — a variable rate and a constant rate — for the case of a single 
receiver in slow fading environment. Straightforward extensions of these schemes for multiple receivers 
reveals the following. The variable rate scheme achieves the our upper bound in (l50l) . whereas the constant 
rate scheme achieve our lower bound in (|5T1) . Since these two expressions coincide as the number of 
receivers tends to infinity, one deduces that the gains of variable rate schemes become negligible in this 
limit. 

Numerical Evaluation of the Upper and Lower Bounds: We plot the upper and lower bounds in the 
high SNR limit in (|54l) in Fig. |4] for the case of i.i.d. Rayleigh fading. Note that the bounds are quite 
close even for a moderate number of users. 
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log- 
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Colluding Attacks: We noted earlier that any number of statistically equivalent eavesdroppers does not 
affect our capacity as long as they do not collude. If the eavesdroppers collude then they can combine 
the received signals and attempt to decode the message. The upper and lower bounds in Lemma [6] can 
be extended by replacing the term |-f^eP with ||He|p, where Hg is the vector of channel gains of the 
colluding eavesdroppers. One conclusion from these bounds is that the secrecy capacity is positive unless 
the colluding eavesdropper population grows as log K. 



VIII. Conclusion 

A generalization of the wiretap channel to the case of parallel and fading channels with multiple 
receivers is considered. We established the common-message-secrecy-capacity for the case of reversely 
degraded parallel channels and provided upper and lower bounds for the general case. For independent 
messages over parallel channels, the sum-secrecy capacity has been determined. For fading channels, we 
examined a fast fading scenario when the transmitter knows the instantaneous channels of all the intended 
receivers but not of the eavesdropper. Interestingly, the common-message- secrecy-capacity does not decay 
to zero as the number of intended receiver grows. For the case of independent messages, it was shown 
that an opportunistic scheme achieves the secrecy-sum-capacity in the limit of large number of users. 

The protocols investigated in this paper relied on time diversity (for the common message) and multiuser 
diversity (for independent messages) to enable secure communication. In situations where such forms of 
diversity is not available, it is of interest to develop a formulation for secure transmission, analogous to 
the outage formulation for slow fading channels. Secondly, the impact of multiple antennas on secure 
transmission is far from being clear at this stage. While multiple antennas can theoretically provide 
significant gains in throughput in the conventional systems, a theoretical analysis for the case of confidential 
messages is naturally of great interest. 



Appendix I 
Proof of Fact [2] 

Let T be a binary valued random variable such that: if T = the induced distribution on X is pq{X), 
i.e., p{Y,Z,X\T = 0) = p{Y, Z\X)pq{X), and if T = 1 the induced distribution on p{X) is pi{X) 
i.e. p{Y,Z,X\T = 1) = p{Y,Z\X)pi{X). Note the Markov chain T ^ X ^ {y,Z). To establish the 
concavity of I{X; Y\Z) in p{X) it suffices to show that 

I{X-Y\Z,T) <I{X-Y\Z). (58) 

The following chain of inequalities can be verified. 

/(X; Y\Z, T) - /(X; Y\Z) = {/(X; F, Z\T) - /(X; Z\T)} - {/(X; Y, Z) - /(X; Z)} (59) 

= {/(X; F, Z\T) - /(X; Z\T)} - {I{TX- F, Z) - I{TX- Z)} (60) 
= {/(X; F, Z\T) - I{TX- Y,Z)}- {/(X; Z\T) - I{TX- Z)} 
= I{T- Z) - I{T- F, Z) = -I{T- Y\Z) < 0. 

Equation (l59l) is a consequence of the chain rule for mutual information. Equation (|60l) follows from the 
fact that T ^ X ^ (F, Z) forms a Markov Chain, so that I{T; Z\X) = I{T; Y, Z\X) = 0. 



Appendix II 
Proof of Lemma [3] 

Since there are Qj = 2"^"=^ codewords per message bin Cj{W) and each codeword is equally likely to 
be selected 



1 

-"v-jrw ^^^^ 
= I{Uj]Yej) -Ef, 



-H{U^\W) = Re, 
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where the last equality follows from the definition of i?ej in (fTSl ). Since the number of codewords in each 
bin is less than 2"^^*^^^'^'=^)"^^), we can select a code that satisfies Fano's inequality 



^H{m\w,Y:^<^^- + eF R, 

J J ^ 



n 



(62) 



The equivocation at the eavesdropper can be lower bounded as 

H{W\Y:^ = H{W, U'^\Y^^ - H{U'^\W, 
>H(UJ\Y:^-n^ 



= HiU^) - I{U^- Y:^ - n7 

= H{W) + H{U;'\W) - liU";- Y^^ - n-f 

> H{W) + nI{Uj; Y,,) - /(t/^; Y^^ - - nsp. 



(63) 
(64) 
(65) 



Here (1631 ) follows from substituting (|62l) . (|64l) from the fact that W is deterministic given f/" and (|65] ) 
follows by substituting (|6T1) . We now show that for a suitably chosen e' > 



I{m-X'j)<nI{U,-Y,,)+ne'. 



(66) 



First note the following 



-iogp(y")-ni/(r,; 



n 



<6, \fy-eT(Yj: 



-\ogpiyJ\u])-nHiYj\U, 



n 



(67) 



<5, ^iy^,u])enYj,Uj). 

From (l67l) we note that 



(68) 



Let J be an indicator function which equals 1 if G T{Yj, Uj 

I{Ul, YJ'IJ = 1) < nI{Uj- Yj) + 2n6 . 

Now we can upper bound I{U"; YJ^) as 

IiU^;YJ^)<I{U^;YJ^,J) 

= I{U^;Y;\J) + IiU^;J) 

< /(?7;; r/l J = 1) + /(f/;; r/l J = 0) Pr(J = 0) + H^iJ) 

< nI{Uf Yj) + 2n6 + ne log |3^| + 1, 

where (|69| ) follows from the fact that /(?7"; J) < Hb{J), the binary entropy of J. The inequality (TTOI) 
follows from the fact that < 1, Pr(J = 0) < e, /(L^; y/| J = 0) < nlog |3^|, and We now 

select 

£' = 2(5 + 5 log 13^1 + -. 

n 



(69) 
(70) 



Combining (1651) and (1701) we have 



-IiW;Y:^^<e' + j + ep 



n 



25 + e\y\ + - + eFRej + eF 
n 



(71) 
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Fig. 5. Decomposition of the two user system into four states. In the first state both users have channel gains above the threshold. In the 
second state only user 1 has channel above the threshold while in the third state only user 2 has channel above the threshold. The fourth 
state both users have channels below the threshold. In any state, a user is colored dark if the channel gain is below the threshold and shaded 
if the channel gain is above the threshold. 



Appendix III 
Alternate Scheme for Theorem [3] 

We present an alternate scheme for Theorem |3l For simplicity we focus on the case of two receivers. 
The case of more than two receivers is analogous. Fix a threshold T > and decompose the system 
into four states as shown in Fig. [51 . The transmission happens over a block of length n and we classify 
t = 1, 2, . . . , n as 



S, = {te{l,n}\\h{t)\'>T,\h2{t)\'>T} 

52 = {te{l,n}\ \h{t)\'>T,\h2{t)\^ <T} 

53 = {te {l,n} I \h{t)\^ < T, |/i2(t)r > T} 
S^ = {te{l,n} I \h{t)\^ <T,\h2{t)\^ <T}. 



(72) 



The resulting channel is a probabilistic parallel channel with probabilities of the four channels as 

= Pr(|/fip > T, \H2\^ > T), p{S2) = Vi{\H^\^ > T, \H2\^ < T), piS^) = Pi{\H,\^ < T, {H^l^ > 
T) and p^S^) = Pr(|i7i|2 < T, ji^aP < T). Also note that with Xj = Uj ~ CX{0, P) in the argument of 
the summation in (l44l) . 



{/(f/,;y;,)-/(f/,;F,,)}- 



0, if \Hi\'^ < T in Sj 

E [log(l + |i^,|2p) - log(l + I > T] , if > T in S^. 

(73) 

Substituting these expressions in the achievable rate expression for the probabilistic parallel channel (l44l) 
we get 



R 



common 



(P) = max min^Pr(|i7ip > T)E log(l + \Hi\^P) - log(l + \HJ\'^P) 

POO 

= max min / (log(l + xP) — E\\og(l + \HJ^P])pi(x)dx 

T>0 l<j<2 Jrp I I j/r- \ / 

POD 

> min / (log(l + xP) - ^[log(l + \He\'^P])pi{x)dx 

l<i<2 J rp^ 
POO 

= min / {log(l + xP) - E[\og{l + \He\^P)]ypi{x)dx 
min E [{log(l + \Hi\^P) - P[log(l + \H,\^P)]y] , 



l<j<2 



\HA^ > T 



(74) 



(75) 



where T* in ^ is the solution to log(l +a;P) - ^[log(l + |i^epP] = 0. (The optimality of T* follows 
from the fact that Pi{x) > and hence the integral is maximized by keeping all terms which are positive 
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and discarding the negative terms, however this is not necessary to note as this is an achievable scheme.) 
Note that (1751 ) coincides with the achievable rate in Theorem [3] for the case of K = 2 users. As remarked 
earlier, this scheme straightforwardly generalizes to more than two receivers. With K receivers we will 
have a total of 2^ states, where each state specifies the subset of users that are above the threshold T*. 



Appendix IV 
Proof of the Upper Bound in Lemma [6] 

Consider the channel with one receiver and one eavesdropper. 

Y{t)=H^^,{t)X{t)+Z{t) 



Y,{t)=H,{t)X{t) + Z,{t). ^^^^ 



Along the lines of Lemma|4]in Section HV-Bl one deduces that the sum- secrecy-capacity of the channel (|40l) 
is upper bounded by the secrecy capacity of the genie- aided-channel (|76l ). It remains to show that an upper 
bound on the secrecy capacity of this channel is 

i?+(P) = max E [{log(l + |//^ax|'P(^max)) " log(l + \H P {H . {11) 

In what follows we will denote the eavesdropper's channel output by Ye{t) = (Ye(t), He(t)) and 
optimistically assume that the sequence -ff^ax known to the sender and the receiver non-causally. 
The joint distribution of the noise variables {Z(t), Ze{t)) is selected to be such that if \He(t)\ < |i/max(^)| 
we have X{t) ^Y{t) Ye{t), otherwise we have X(t) Ye{t) ^Y{t). 

Suppose for this channel and the sequence H^^^, there is a sequence of {n, 2"^) codes that achieve 
perfect secrecy in Definition [6l Following the derivation of the upper bound Theorem |2l we have 

nR < I{W; Y^\HU - I{W- Y:\HU + ne 

< I{W- Y\ FeV^^ax) - m\ nl^max) + ^lE 

= I{W;Y-\H^^^,Y:)+ne 

<I{X--,Y-\Hl,^,Y:) + ne (78) 

n 

< Y,HX{t);Y{t)\H^Ut),ye{t)) +ne (79) 
t=i 

where (|78]) follows from the fact that W (X'', Y^") follows a Markov chain and from the 

fact that the channel is memoryless. 

Now let Hn be the set of all fades that have been realized, i.e., 

7^„ = {7 I 3t G [1, n], /7^ax(t) = 7} , (80) 

let N-y denote the number of times in the interval [0, n] that the channel has fade 7, and let S-y denote the 
time indices corresponding to a fade 7, i.e., 

S^ = {t\l<t<n, lif^axWI' =7} 7 e Ha. 
Letting the average transmitted power at time t E he denoted as -P"(t) we have 

P"(t) = E[|X(t)p] teS^ (81) 

where the expectation is over the set of transmitted messages and any stochastic mapping used by the 
encoder. Let denote the average power transmitted with fade level 7 

1 otherwise 
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We will need the following Lemma, which follows from the capacity for the Gaussian wiretap chan- 
nel [13]. 

Lemma 7: Let (X, F, Yg) be random variables such that Y = + and Yg = ^JJiX + Z^.. Suppose 
that Zr ~ CA/'(0, 1) and Z^ ~ CA/'(0, 1) and that the joint distribution of (Z^, Z^ satisfies X -^Y 
if \\A < \l\ and X ^ Fg ^ ^ otherwise. Then we have 

max J(X; FlFe) = log(l + 7P) - log(l + min(7, /i)P) . (83) 

Now we have 

n / 

~ i/^ax(t),^;(t) 



70 



Y^l\x{t)-Y{t) 

t=\ \ 

E^f^W'^WI ^max(t)|' = 70,>;(t) 1 (84) 
^(^W^^W |i^max(t)r = 70,>;(t),|i^e(t)r = /i)M/^l (85) 

oGW„te5^o 1^^"° V /J 
^ E E { r(Ml+7oP"(t))-log(l + min(7o,/i)P"(t)))M/^| (86) 

< 5^ 5^(log(l+7oP"(t))-i5^^[log(l + min(7o,/i)P"(t)))] 

7oe'H„ tG5^Q 

< 5^ iV,„(log(l + 7oP;)-i5^[log(l + min(7o,/i)P;)]), (87) 

7oG'H„ 

where ([84]) follows by re- writing the summation over the set Jin, ([85[) follows from the independence of 
ife(^) and H^sixit), ([86[ ) follows from Lemma [7] and ([87[) is justified from the fact that for any 70 > 0, 
the expression "^-y^iy) = log(l + 7o2/) ~ -^[log(l + niin(7o, /i)?/)] is a concave function in y for y > 0, i.e., 

E ^(^70 ^ ^^0^ f ^ E ^;oW I = ^^70^(^7")- 

Combining ([79]) and ([87]) we get 

R<e+ J2 log(l + 7oP;)-i^;.[log(l + min(7o,/i)P;)]^. (88) 

Now note that, for each n, we have J^^P^^^d'y < P. Thus for each n, the set of points P^^, indexed by 
7o, lie in a compact space. For this sequence of points, there exists a convergent subsequence P^,' that 
converges to some power allocation Py^ as rij ^ 00. Taking limit along the converging subsequence of 
the upper bound on the rate ([88]) 

poo 

R< / log(l + 7P7)-^[Ml + min(7,/i)Py)Krf7 

= ^[log(l + 7^) - log(l + min(7, fx)P^)], 
and this completes the proof of the upper bound. 
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Appendix V 
Helper Lemma in the proof of Theorem [4] 

Lemma 8: Let Hi, H2, . . . , Hk, He be i.i.d. unit mean exponentials. For K > 2, we have 



E 



log 



H |2 
-'-'max 



-'^ e _ -n max 



< 21ok2 



First note the following. 

Fact 3 ( [4]): Let Vi,V2, ■ . . ,Vk, Vk+i be i.i.d. exponential random variables with mean A and Vmax(-^ + 1) 
denotes the largest of these exponential and Kiax(-^) the second largest. The joint distribution of (Kiax(-f^), Knax(-^ -I" 
satisfies 

K,ax(i^+1) =KnaxW+>^, 



(89) 



where Y is an exponential random variable with mean A and is independent of V^ax(-^) 
Proof: We have 



E 



log 



\He 



Hr, 



\Hf.\ > \H„ 



= E 
< E 



log 



\H 


max 


2 + F 




-^max 


2 



Y 



\H |2 

max 



E[Y]E 
E 



\H |2 

-'-'max 



H P 

-'-' max 



(90) 

(91) 
(92) 
(93) 



where (|9T| ) follows from the identity log(l + x) < x for a; > 0, (|92| ) follows from the independence of F 
and ifmax, and (l93l) from the fact that = 1. Since |-ffmaxP > max(|ifip, |-f^2n we obtain 



E 



1 






< E 


_ l-'-'maxI 





max(|ifip, \H2\ 



< 2 log 2. 
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